Topic: New fonera model FON2200

Hi all.

I got today the fonera, but its not the usual FON2100. This 2200 model have a 7.5v 1A power supply, no heat dissipator (i suppose they fixed high temperature issues) and different pcb layout.
Some pictures in http://zone-sys.net/fon2/

The kolofonium hack and camicia kernel for redboot went ok, but the redboot seems to be different:

The fis init is same as the 2100 model:

RedBoot> fis init
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

But the load command gives me an warning, saying that address 0x80040450 is not in RAM
If I press yes, it gives me an error:

RedBoot> load -r -v -b 0x80040450 openwrt-atheros-2.6-root.jffs2-64k
Using default protocol (TFTP)
Specified address (0x80040450) is not believed to be in RAM - continue (y/n)? y
Can't load 'openwrt-atheros-2.6-root.jffs2-64k': invalid parameter
RedBoot>

Tftp is working correctly:

# tftp 192.168.1.10
tftp> get openwrt-atheros-2.6-root.jffs2-64k
Received 1714367 bytes in 0.3 seconds
tftp>

The fis list output is:

RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0xA8000000  0xA8000000  0x00030000  0x00000000
FIS directory     0xA87E0000  0xA87E0000  0x0000F000  0x00000000
RedBoot config    0xA87EF000  0xA87EF000  0x00001000  0x00000000
RedBoot>

I fear to power off the fonera now, I dont want a 20€ brick sad

Somebody know what can I do for install openwrt?
Thanks

Re: New fonera model FON2200

Ok, I have new info.

The old fonera ram starts at 0x80040450:

Board: ap51
RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.

But the new fonera 2200 seems to be a little different and starts at 0x80040aa0 (0x650 higher):

Board: FON1 
RAM: 0x80000000-0x81000000, [0x80040aa0-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.

So I suppose that I should use:
load -r -v -b 0x80040450 openwrt-atheros-2.6-root.jffs2-64k

And the same in the base address in:
fis create -b 0x80040450 -f 0xA8030000 -l 0x00700000 -e 0x00000000 rootfs

But I should touch the other address too?
And what about:
fis create -r 0x80041000 -e 0x80041000 vmlinux.bin.l7

Any help?
Thanks!

Re: New fonera model FON2200

any new hardware specs on the FON2200? i'm curious...

Re: New fonera model FON2200

mib_force wrote:

any new hardware specs on the FON2200? i'm curious...

I still dont know because I'm stuck now with the flashing problem sad

The chip atheros (i can see it because no heat dissipator) says: AR2315A
The RedBoot says that the ram is in [0x80040aa0-0x80fe1000] instead of [0x80040450-0x80fe1000]
So I suppose I have 1k less of ram sad

The serial interface is different, I dont have the 10 pins like the old model, I have only 4 pins in the pcb label JP1.
There is a JP2 but it have not pins, only pcb holes but almost all of them connected to GND.

The only good issue is that it seems it will not burn (or maybe they forgot to put the heat dissipator big_smile)

Re: New fonera model FON2200

Hmm, I'm to tired of playing the game of cat-and-mouse again.

Yeah, back to my Soekris net4801 X86 board smile

1x ASUS WL-700g Encore (Kamikaze 7.09, BCM947xx//953xx [2.4])
1x ASUS WL-500g Premium with Wistron CM9 WiFi card (Kamikaze 7.09, BCM947xx//953xx [2.4])
1x Linksys WRT54GL v1.1 with 512MB MMC card mod, optimized MMC driver (Kamikaze trunk r9548, BCM947xx//953xx [2.4])
NO support via PM.

Re: New fonera model FON2200

I managed to install dd-wrt because their ram offsets start at 0x80041000 that is under the ram address:

fis init
load -r -v -b 0x80041000 root.fs
fis create -b 0x80041000 -f 0xA8030000 -l 0x002C0000 -e 0x00000000 rootfs
load -r -v -b 0x80041000 vmlinux.bin.l7
fis create -r 0x80041000 -e 0x80041000 -l 0x000E0000 vmlinux.bin.l7
fis create -f 0xA83D0000 -l 0x00010000 -n nvram

Re: New fonera model FON2200

you don't need to specify a specific offset to load an image into memory unless you have a reason to, and you don't, for flashing, unless you want to take advantage of defaults later on. read the redboot docs people smile

8 (edited by jshamlet 2007-04-25 18:02:25)

Re: New fonera model FON2200

The old serial connector only had 4 "live" pins anyway, so it makes sense that they eliminated the extra pins. A shame, as you could trivially reroute the unused GPIO to those unused pins - but alas.

I also noted that there isn't a second antenna pad, so no antenna diversity or dual antennas. Also missing is the RP-SMA connector pad. The only option now is a coax soldered to the board.

All in all, it looks like a cost reduction. This board looks significantly "cheaper" than the original 2100.

That said, I wonder how they got the heat problem solved. Did they "underclock" the Atheros chip?

On the upside, it looks like the SDRAM should be easier to replace, as there are a lot fewer discretes nearby. I only count 4 caps in the vicinity of the SDRAM.

[edit] The second antenna is there - as a PCB trace. Look at the strangely shaped trace in the lower left corner, and you can see on the silkscreen ANT2. I wonder if it is being used by the firmware?

Re: New fonera model FON2200

It does look much cheaper. Maybe they did take out all the gpios and serial port to prevent people from hacking the fon...

Re: New fonera model FON2200

jshamlet wrote:

The old serial connector only had 4 "live" pins anyway, so it makes sense that they eliminated the extra pins. A shame, as you could trivially reroute the unused GPIO to those unused pins - but alas.

But these 4 pins seems not to be connected to the pcb, maybe they removed it for people not hack it as GoldServe says.

jshamlet wrote:

I also noted that there isn't a second antenna pad, so no antenna diversity or dual antennas. Also missing is the RP-SMA connector pad. The only option now is a coax soldered to the board.
[edit] The second antenna is there - as a PCB trace. Look at the strangely shaped trace in the lower left corner, and you can see on the silkscreen ANT2. I wonder if it is being used by the firmware?[/edit]

Yes, I noticed the ANT2 too, but its connected to pcb ground, but near the serial number there is a small circle that connects to the back side of the pcb, maybe that is the second antenna connector.

the RP-SMA connector for the first antenna is the same.

jshamlet wrote:

All in all, it looks like a cost reduction. This board looks significantly "cheaper" than the original 2100.

That said, I wonder how they got the heat problem solved. Did they "underclock" the Atheros chip?

Yes, that's my impression too sad
The heat problem is solved, I can touch the chip and is not hot. I still didnt tried under heavy load, but if they didn't put a heat dissipator I suppose they solved it.

I think is not underclocked, /proc/cpuinfo says 183.50 bogomips. I suppose that the heat problem was produced by bad board design, so thats why now they changed the power supply from 5v to 7.5v

On the upside, it looks like the SDRAM should be easier to replace, as there are a lot fewer discretes nearby. I only count 4 caps in the vicinity of the SDRAM.

Re: New fonera model FON2200

This is definitely a multi-layer board, so it is possible that the serial lines are on interior layers. Why the suspicion that J1 isn't connected to anything?

Does anyone have one of these beasts, and access to either a LVTTL -> RS232 converter or a scope?

Re: New fonera model FON2200

jshamlet wrote:

This is definitely a multi-layer board, so it is possible that the serial lines are on interior layers. Why the suspicion that J1 isn't connected to anything?

Does anyone have one of these beasts, and access to either a LVTTL -> RS232 converter or a scope?

I didnt know that multi-layer boards exist. In fact it had no sense to have pins not connected to anything big_smile

In fonera.info superpowerd says that the pinout starting from the nearest to power supply are:

1-----------Gnd
2---------- TX
3---------- RX

Re: New fonera model FON2200

Hi,
You can see the connection schematic for the new Fonera FON2200 at:
www.radikaldesig.com

And a RS232 >--< TTL level converter at :
http://radikaldesig.blogspot.com/2007/01/conversor-rs232-ttl.html

Cheers,

14 (edited by DiarmuidWrenne 2007-05-02 11:07:01)

Re: New fonera model FON2200

http://tech.am/2006/10/06/autopsy-of-a-fonera/

You can see that the fon photo now is very similar to the Meraki. The power supply caps, voltage regs and flash position all look similar, but just a bit different too. Also, the Meraki runs off 7.5 volt. I bet Atheros and accton provided both with design expertise and reference designs.

EDIT:
I had a chat with a guy in Accton some time ago. I was doing some numbers work for a feasibility study and wanted to know rough pricing. He was saying that at the 30,000 unit mark, Accton would take on a significant amount of the design work. He reckoned the $50 mark was about as cheap as those units were going to get.

I had looked at the chips from http://www.Axis.se and am using a board from http://www.acmesystems.it that works well and supports USB which is essential for me. I wish the Meraki guys would include USB as it would be great for video and music downloads. They could tie in with a video sharing site or company like Joost so that your programs would be downloaded while you are away on a computer that draws only 1 watt. Joost would love it as it would help their P2P download model.


Cheers

Diarmuid

Check out my blog on hacking the Meraki Mini and other embedded systems on http://designbuildtestrepeat.wordpress.com

15 (edited by metyl 2008-02-14 22:41:11)

Re: New fonera model FON2200

pinout on fon2200 is below, but cable needs to switch RX/TX
1.) GND 
2.) RX (here is 0V)
3.) TX (here is 3.3V also)
4.) +3.3V

output from boot:

+Ethernet eth0: MAC address 00:18:XX:XX:XX:XX
IP: 192.168.1.1/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.254

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version V1.00 - built 10:37:27, Dec 12 2006

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: FON1
RAM: 0x80000000-0x81000000, [0x80040aa0-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 2.000 seconds - enter ^C to abort

== Executing boot script in 2.000 seconds - enter ^C to abort
RedBoot> fis load -l vmlinux.bin.l7
Image loaded from 0x80041000-0x801ba000
RedBoot> exec
Now booting linux kernel:
 Base address 0x80030000 Entry 0x80190040
 Cmdline :
CPU revision is: 00019064
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
Linux version 2.4.32 (iurgi@ropero) (gcc version 3.4.6 (OpenWrt-2.0)) #8 lun ene 8 12:33:21 UTC 2007
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2
Using 92.000 MHz high precision timer.
Calibrating delay loop... 183.50 BogoMIPS
Memory: 14188k/16384k available (1327k kernel code, 2196k reserved, 92k data, 68k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  available.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
squashfs: version 3.0 (2006/03/15) Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xb1100003 (irq = 37) is a 16550A
eth0: Dropping NETIF_F_SG since no checksum feature.
eth0: Atheros AR2313: 00:18:XX:XX:XX:XX, irq 4
MTD driver for SPI flash.
spiflash: Probing for Serial flash ...
spiflash: Found SPI serial Flash.
8388608: size
Creating 8 MTD partitions on "spiflash":
0x00000000-0x00030000 : "RedBoot"
0x00030000-0x00720000 : "rootfs"
0x001b0000-0x00720000 : "rootfs1"
0x00720000-0x00730000 : "config"
0x00730000-0x007e0000 : "vmlinux.bin.l7"
0x007e0000-0x007ef000 : "FIS directory"
mtd: partition "FIS directory" doesn't end on an erase block -- force read-only
0x007ef000-0x007f0000 : "RedBoot config"
mtd: partition "RedBoot config" doesn't start on an erase block boundary -- force read-only
0x007f0000-0x00800000 : "board_config"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
eth0: Configuring MAC for full duplex
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
ip_conntrack version 2.1 (5953 buckets, 5953 max) - 328 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 68k freed
init started:  BusyBox v1.1.3 (2006.11.27-12:40+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5

Please press Enter to activate this console.

i've executed this in a row.... to flash openwrt

RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0xA8000000  0x80040C00  0x00030000  0xA8000000
rootfs            0xA8030000  0xA8030000  0x00700000  0x00000000
vmlinux.bin.l7    0xA8730000  0x80041000  0x000B0000  0x80190040
FIS directory     0xA87E0000  0xA87E0000  0x0000F000  0x00000000
RedBoot config    0xA87EF000  0xA87EF000  0x00001000  0x00000000
RedBoot> fconfig -l
Run script at boot: true
Boot script:
.. fis load -l vmlinux.bin.l7
.. exec

Boot script timeout (1000ms resolution): 2
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.1.1
Local IP address mask: 0.0.0.0
Default server IP address: 192.168.1.254
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot> fis init
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0xA8000000  0xA8000000  0x00030000  0x00000000
FIS directory     0xA87E0000  0xA87E0000  0x0000F000  0x00000000
RedBoot config    0xA87EF000  0xA87EF000  0x00001000  0x00000000
RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma
Using default protocol (TFTP)
Raw file loaded 0x80040c00-0x80100bff, assumed entry at 0x80040c00

what address should I use there ?

RedBoot> fis create -e 0x80041000 -r 0x80041000 vmlinux.bin.l7
... Erase from 0xa8030000-0xa80f0000: ............
... Program from 0x80040c00-0x80100c00 at 0xa8030000: ............
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot> fis free
  0xA80F0000 .. 0xA87E0000

EDIT: aghhh so what is the freespace left

localhost:~# bc
obase=16
ibase=16
A87E0000 - A80F0000
6F0000

0xA87E0000 - 0xA80F0000 = 0x06F0000

RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs
Using default protocol (TFTP)
Raw file loaded 0x80040c00-0x80160bff, assumed entry at 0x80040c00
RedBoot> fis create -l 0x06F0000 rootfs
... Erase from 0xa80f0000-0xa87e0000: ...............................................................................................................
... Program from 0x80040c00-0x80160c00 at 0xa80f0000: ..................
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .

finally we can just reboot or

RedBoot> fis load -l vmlinux.bin.l7
Image loaded from 0x80041000-0x80290085
RedBoot> exec

and we got openwrt compiled by nbd smile

Now booting linux kernel:
 Base address 0x80030000 Entry 0x80041000
 Cmdline :
Linux version 2.6.21.5 (nbd@ds10) (gcc version 4.1.2) #2 Sun Sep 30 20:16:16 CEST 2007
CPU revision is: 00019064
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists.  Total pages: 4064
Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2 init=/etc/preinit
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 64 (order: 6, 256 bytes)
Using 92.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13504k/16384k available (1955k kernel code, 2880k reserved, 292k data, 116k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Radio config found at offset 0xf8(0x1f8)
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0xb1100003 (irq = 37) is a 16550A
eth0: Dropping NETIF_F_SG since no checksum feature.
eth0: Atheros AR231x: 00:18:xx:xx:xx:xx, irq 4
cmdlinepart partition parsing not available
Searching for RedBoot partition table in spiflash at offset 0x7d0000
Searching for RedBoot partition table in spiflash at offset 0x7e0000
5 RedBoot partitions found on MTD device spiflash
Creating 5 MTD partitions on "spiflash":
0x00000000-0x00030000 : "RedBoot"
0x00030000-0x000f0000 : "vmlinux.bin.l7"
0x000f0000-0x007e0000 : "rootfs"
0x001f0000-0x007e0000 : "rootfs_data"
0x007e0000-0x007ef000 : "FIS directory"
0x007ef000-0x007f0000 : "RedBoot config"
nf_conntrack version 0.5.0 (128 buckets, 1024 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP vegas registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 116k freed
eth0: Configuring MAC for full duplex
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
jffs2 not ready yet; using ramdisk
mini_fo: using base directory: /
mini_fo: using storage directory: /tmp/root
- init -
init started:  BusyBox v1.4.2 (2007-09-29 07:21:40 CEST) multi-call binary

Please press Enter to activate this console. device eth0 entered promiscuous mode
br-lan: port 1(eth0) entering learning state
br-lan: topology change detected, propagating
br-lan: port 1(eth0) entering forwarding state
PPP generic driver version 2.4.2
wlan: 0.8.4.2 (svn r2568)
ath_hal: module license 'Proprietary' taints kernel.
ath_hal: 0.9.30.13 (AR5212, AR5312, RF2316, TX_DESC_SWAP)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (svn r2568)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_ahb: 0.9.4.5 (svn r2568)
ath_pci: switching rfkill capability off
ath_pci: switching per-packet transmit power control off
wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: H/W encryption support: WEP AES AES_CCM TKIP
wifi0: mac 11.0 phy 4.8 radio 7.0
wifi0: Use hw queue 1 for WME_AC_BE traffic
wifi0: Use hw queue 0 for WME_AC_BK traffic
wifi0: Use hw queue 2 for WME_AC_VI traffic
wifi0: Use hw queue 3 for WME_AC_VO traffic
wifi0: Use hw queue 8 for CAB traffic
wifi0: Use hw queue 9 for beacons
wifi0: Atheros 2315 WiSoC: mem=0xb0000000, irq=3
jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
jffs2_build_filesystem(): unlocking the mtd device... done.
jffs2_build_filesystem(): erasing all blocks after the end marker... done.
mini_fo: using base directory: /
mini_fo: using storage directory: /jffs

BusyBox v1.4.2 (2007-09-29 07:21:40 CEST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (7.09) -----------------------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/#

EDIT: finally i've got this to work

thanks to all docu everywhere for example

https://neophob.com/serendipity/index.p … mmies.html
http://wiki.freifunk-hannover.de/Fonera_mit_OLSR
http://www.easy2design.de/bla/?page_id=98#image_transfer

pretty small nice piece of hw anyway

happy hacking